<!DOCTYPE html>
<html lang="en">
<head>
	<meta charset="UTF-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
	<title>ip_range 聚合 | ElasticSearch 7.7 权威指南中文版</title>
	<meta name="keywords" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <meta name="description" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
	<link rel="stylesheet" type="text/css" href="../static/styles.css" />
	<script>
	var _link = 'search-aggregations-bucket-iprange-aggregation.html';
    </script>
</head>
<body>
<div class="main-container">
    <section id="content">
        <div class="content-wrapper">
            <section id="guide" lang="zh_cn">
                <div class="container">
                    <div class="row">
                        <div class="col-xs-12 col-sm-8 col-md-8 guide-section">
                            <div style="color:gray; word-break: break-all; font-size:12px;">原英文版地址: <a href="https://www.elastic.co/guide/en/elasticsearch/reference/7.7/search-aggregations-bucket-iprange-aggregation.html" rel="nofollow" target="_blank">https://www.elastic.co/guide/en/elasticsearch/reference/7.7/search-aggregations-bucket-iprange-aggregation.html</a>, 原文档版权归 www.elastic.co 所有<br/>本地英文版地址: <a href="../en/search-aggregations-bucket-iprange-aggregation.html" rel="nofollow" target="_blank">../en/search-aggregations-bucket-iprange-aggregation.html</a></div>
                        <!-- start body -->
                  <div class="page_header">
<strong>重要</strong>: 此版本不会发布额外的bug修复或文档更新。最新信息请参考 <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html" rel="nofollow">当前版本文档</a>。
</div>
<div id="content">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="index.html">Elasticsearch 权威指南 [7.7]</a></span>
»
<span class="breadcrumb-link"><a href="search-aggregations.html">聚合</a></span>
»
<span class="breadcrumb-link"><a href="search-aggregations-bucket.html">桶(bucket)聚合</a></span>
»
<span class="breadcrumb-node">ip_range 聚合</span>
</div>
<div class="navheader">
<span class="prev">
<a href="search-aggregations-bucket-histogram-aggregation.html">« histogram 聚合</a>
</span>
<span class="next">
<a href="search-aggregations-bucket-missing-aggregation.html">missing 聚合 »</a>
</span>
</div>
<div class="section">
<div class="titlepage"><div><div>
<h2 class="title">
<a id="search-aggregations-bucket-iprange-aggregation"></a>IP范围(ip_range)聚合
</h2>
</div></div></div>
<p>与专用的<a class="xref" href="search-aggregations-bucket-daterange-aggregation.html" title="日期范围聚合">date</a>范围聚合一样，IP类型的字段也有专用的范围聚合：
</p>
<p>示例：</p>
<div class="pre_wrapper lang-console">
<pre class="programlisting prettyprint lang-console">GET /ip_addresses/_search
{
    "size": 10,
    "aggs" : {
        "ip_ranges" : {
            "ip_range" : {
                "field" : "ip",
                "ranges" : [
                    { "to" : "10.0.0.5" },
                    { "from" : "10.0.0.5" }
                ]
            }
        }
    }
}</pre>
</div>
<div class="console_widget" data-snippet="snippets/481.console"></div>
<p>响应：</p>
<div class="pre_wrapper lang-console-result">
<pre class="programlisting prettyprint lang-console-result">{
    ...

    "aggregations": {
        "ip_ranges": {
            "buckets" : [
                {
                    "key": "*-10.0.0.5",
                    "to": "10.0.0.5",
                    "doc_count": 10
                },
                {
                    "key": "10.0.0.5-*",
                    "from": "10.0.0.5",
                    "doc_count": 260
                }
            ]
        }
    }
}</pre>
</div>
<p>IP范围也可以定义为CIDR掩码(mask)：</p>
<div class="pre_wrapper lang-console">
<pre class="programlisting prettyprint lang-console">GET /ip_addresses/_search
{
    "size": 0,
    "aggs" : {
        "ip_ranges" : {
            "ip_range" : {
                "field" : "ip",
                "ranges" : [
                    { "mask" : "10.0.0.0/25" },
                    { "mask" : "10.0.0.127/25" }
                ]
            }
        }
    }
}</pre>
</div>
<div class="console_widget" data-snippet="snippets/482.console"></div>
<p>响应：</p>
<div class="pre_wrapper lang-console-result">
<pre class="programlisting prettyprint lang-console-result">{
    ...

    "aggregations": {
        "ip_ranges": {
            "buckets": [
                {
                    "key": "10.0.0.0/25",
                    "from": "10.0.0.0",
                    "to": "10.0.0.128",
                    "doc_count": 128
                },
                {
                    "key": "10.0.0.127/25",
                    "from": "10.0.0.0",
                    "to": "10.0.0.128",
                    "doc_count": 128
                }
            ]
        }
    }
}</pre>
</div>
<div class="section">
<div class="titlepage"><div><div>
<h3 class="title">
<a id="_keyed_response_6"></a>keyed 响应
</h3>
</div></div></div>
<p>将<code class="literal">keyed</code>标志设置为<code class="literal">true</code>会将唯一的字符串键与每个桶相关联，并将范围作为哈希而不是数组返回：</p>
<div class="pre_wrapper lang-console">
<pre class="programlisting prettyprint lang-console">GET /ip_addresses/_search
{
    "size": 0,
    "aggs": {
        "ip_ranges": {
            "ip_range": {
                "field": "ip",
                "ranges": [
                    { "to" : "10.0.0.5" },
                    { "from" : "10.0.0.5" }
                ],
                "keyed": true
            }
        }
    }
}</pre>
</div>
<div class="console_widget" data-snippet="snippets/483.console"></div>
<p>响应：</p>
<div class="pre_wrapper lang-console-result">
<pre class="programlisting prettyprint lang-console-result">{
    ...

    "aggregations": {
        "ip_ranges": {
            "buckets": {
                "*-10.0.0.5": {
                    "to": "10.0.0.5",
                    "doc_count": 10
                },
                "10.0.0.5-*": {
                    "from": "10.0.0.5",
                    "doc_count": 260
                }
            }
        }
    }
}</pre>
</div>
<p>也可以为每个范围自定义一个键：</p>
<div class="pre_wrapper lang-console">
<pre class="programlisting prettyprint lang-console">GET /ip_addresses/_search
{
    "size": 0,
    "aggs": {
        "ip_ranges": {
            "ip_range": {
                "field": "ip",
                "ranges": [
                    { "key": "infinity", "to" : "10.0.0.5" },
                    { "key": "and-beyond", "from" : "10.0.0.5" }
                ],
                "keyed": true
            }
        }
    }
}</pre>
</div>
<div class="console_widget" data-snippet="snippets/484.console"></div>
<p>响应：</p>
<div class="pre_wrapper lang-console-result">
<pre class="programlisting prettyprint lang-console-result">{
    ...

    "aggregations": {
        "ip_ranges": {
            "buckets": {
                "infinity": {
                    "to": "10.0.0.5",
                    "doc_count": 10
                },
                "and-beyond": {
                    "from": "10.0.0.5",
                    "doc_count": 260
                }
            }
        }
    }
}</pre>
</div>
</div>

</div>
<div class="navfooter">
<span class="prev">
<a href="search-aggregations-bucket-histogram-aggregation.html">« histogram 聚合</a>
</span>
<span class="next">
<a href="search-aggregations-bucket-missing-aggregation.html">missing 聚合 »</a>
</span>
</div>
</div>

                  <!-- end body -->
                        </div>
                        <div class="col-xs-12 col-sm-4 col-md-4" id="right_col">
                        
                        </div>
                    </div>
                </div>
            </section>
        </div>
    </section>
</div>
<script src="../static/cn.js"></script>
</body>
</html>